Resisting the spread of unwanted code and data

• US 8,869,283 B2
• Filed: 04/04/2012
• Issued: 10/21/2014
• Est. Priority Date: 06/09/2005
• Status: Expired due to Fees

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Scales, Nicholas John
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US13/438,933
• Publication Number:
  US 20120278894A1
• Time in Patent Office: 930 Days
• Field of Search: 726/1, 726/22, 726/24, 713/154, 713/165, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method or system of receiving an electronic file containing content data in a predetermined data format, the method comprising the steps of: receiving the electronic file, determining the data format, parsing the content data, to determine whether it conforms to the predetermined data format, and if the content data does conform to the predetermined data format, regenerating the parsed data to create a regenerated electronic file in the data format.

Claims

1. A method for processing an electronic file to create a substitute electronic file containing only allowable content data, the method comprising:

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specfied in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has pre-approved the predetermined file type when associated with the sender of electronic file.

2. A method according to claim 1 in which the values or range of values corresponds to a subset of the predetermined set of rules for each file type.

3. A method according to claim 1 comprising determining whether the content data conforms to prior known examples of acceptable data.

4. A method according to claim 3 in which the values or range of values only includes allowable control characters.

5. A method according to claim 3 in which the values or range of values define predetermined size limits.

6. A method according to claim 5 wherein the predetermined size limit is the size of a line in an image file.

7. A method according to claim 1 further comprising storing the incoming electronic file in a scrambled format in memory.

8. A method according to claim 7, wherein each byte of data is stored in a bit reversed order.

9. A method according to claim 7, wherein the data is stored such that each pair of data bytes received is placed in a reversed memory order.

10. A method according to claim 1, further comprising replacing any content data that does not conform with warning text.

11. A method according to claim 1, wherein the incoming electronic file is an e-mail and the method further comprises forwarding the regenerated e-mail to the intended recipient if the content data conforms to the values or range of values specified in the set of rules.

12. A method according to claim 11, wherein the substitute regenerated e-mail is forwarded from an e-mail client to a hard disk drive.

13. A method according to claim 1, wherein the substitute regenerated e mail is forwarded from an Internet server provider server to an e-mail client server.

14. A method according to claim 1, further comprising receiving the incoming electronic file from a removable memory device, and forwarding the substitute regenerated electronic file to a computing device.

15. A method for processing an electronic file to create a substitute electronic file containing only allowable content data the method comprising:

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

16. A device for processing an electronic file to create a substitute electronic file containing only allowable content data comprising:

a memory; and

a computer processor in communication with the memory, the processor executes a program stored in said memory to perform the steps of;

receiving an incoming electronic file, said file containing content data in a pre-determined data file type;

determining purported predetermined data file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the determined at least one portion of allowable content data; and

creating a substitute electronic file in the purported predetermined data file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has preapproved the predetermined file type when associated with the sender of the electronic file.

17. A semiconductor device comprising:

a memory for storing computer instructions executable by a computer to perform the steps of;

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has pre-approved the predetermined file type when associated with the sender of the electronic file.

18. A semiconductor device according to claim 17, wherein the semiconductor device is a semi-permanent or permanent memory device.

19. A network card comprising:

a semiconductor device configured to store computer instructions executable by a computer to perform the steps of;

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has pre-approved the predetermined file type when associated with the sender of the electronic file.

20. A semiconductor device comprising:

a memory for storing computer instructions executable by a computer to perform the steps of;

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

21. A device for processing an electronic file to create a substitute electronic file containing only allowable content data comprising:

a memory; and

a computer processor in communication with the memory, the processor executes a program stored on said memory to perform the steps of;

receiving an incoming electronic file, said file containing content data in a pre-determined data file type;

determining purported predetermined data file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determination determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the determined at least one portion of allowable content data;

creating a substitute electronic file in the purported predetermined data file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not preapproved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

22. A non-transitory computer-readable storage medium comprising a computer program executable by a computer to perform the steps of:

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has pre-approved the predetermined file type when associated with the sender of the electronic file.

23. A non-transitory computer-readable storage medium comprising a computer program executable by a computer to perform the steps of:

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the received electronic file and an associated set of rules specifying values or range of values of allowable content data;

determining at least an allowable portion of the content data that conforms with the values or range of values specified in the set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, only the at least an allowable portion of content data;

creating a substitute electronic file in the purported file type, said substitute electronic file containing only the extracted allowable content data;

forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the values or range of values specified in the set of rules; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.